Linux LKM Load via insmod/modprobe of .ko File
Detects the loading of Linux kernel modules using insmod or modprobe from non-standard, writable directories such as /tmp, /var/tmp, /dev/shm, /home, /root, or /opt. This behavior is highly indicative of an adversary attempting to install a malicious kernel module or rootkit to gain persistence or privilege escalation, while bypassing standard package management paths.
Microsoft Sentinel (KQL)
